ChainThink report, the XRP Ledger has fixed a payment system vulnerability that may have existed since 2015.

The flaw could allow an attacker to bypass token exchange amount calculation limits through specially crafted payment transactions, generating and spending large quantities of XRP, thereby undermining the hard cap of 100 billion XRP.

An attacker could create hundreds of accounts posting offers to exchange small amounts of tokens for large amounts of XRP, then execute a single payment transaction to complete all trades simultaneously. Due to a defect in the system's transaction total calculation, the seller account might receive the full amount of XRP while the buyer pays almost nothing in return.

The vulnerability was reported by researchers Cayden Liao and Veria AI on September 22; RippleX subsequently reproduced the attack and confirmed that the generated XRP could be used in subsequent transactions.

RippleX stated that there is currently no evidence indicating the vulnerability has been exploited on any public network; the development team released the xrpld 3.4.1 update on September 25 to patch the issue.